CVE-2021-37712

🗓️ 31 Aug 2021 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 587 Views

npm package "tar" has arbitrary file creation/overwrite and code execution vulnerability before versions 4.4.18, 5.0.10, 6.1.9

Reporter	Title	Published	Views	Family All 186
IBM Security Bulletins	Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 May 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	23 Nov 202115:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-37712)	2 Dec 202118:13	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-37712)	22 Apr 202219:45	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager Virtual Appliance	30 Jun 202305:54	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	18 Oct 202213:51	–	ibm

NVD

Vulners

Node

npmjs tarRange≤4.4.17node.js

npmjs tarRange5.0.0–5.0.9node.js

npmjs tarRange6.0.0–6.1.8node.js

AND

microsoft windowsMatch-

Node

debian debian_linuxMatch10.0

debian debian_linuxMatch11.0

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

[
  {
    "vendor": "npm",
    "product": "node-tar",
    "versions": [
      {
        "version": "< 4.4.18",
        "status": "affected"
      },
      {
        "version": ">= 5.0.0, < 5.0.10",
        "status": "affected"
      },
      {
        "version": ">= 6.0.0, < 6.1.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
lists	www.lists.debian.org/debian-lts-announce/2022/12/msg00023.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html
github	www.github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
npmjs	www.npmjs.com/package/tar
debian	www.debian.org/security/2021/dsa-5008

21 Nov 2024 06:15Current

7.5High risk

Vulners AI Score7.5

CVSS 24.4

CVSS 3.18.2 - 8.6

EPSS0.00085